A security investigation has found that more than 35,000 applications created with Grok Build, an artificial intelligence app-building tool, were accessible to the public without requiring users to sign in, potentially exposing sensitive business information.
Research published on November 10 by security firm Claroc revealed that anyone who obtained the web address of a Grok Build application could access its contents.
Among the exposed applications were 24 belonging to employees of SpaceXSI, the company behind Grok. The applications contained confidential materials, including an employee onboarding plan, a sales territory map and advertising proposals.
Claroc said SpaceXSI took its 24 applications offline following the disclosure but left applications belonging to other Grok users accessible.
However, Ars Technica reporter Dan Goodin reported that SpaceXSI began removing the remaining applications within hours of receiving his email seeking comments on the findings.
Grok Build allows users to create functional applications by entering descriptions through a chat interface. Users can subsequently publish the applications online through individual web addresses hosted on grok.me.
To assess the extent of the exposure, Claroc tested more than 43,500 Grok Build application addresses.
Of the 37,571 applications that remained online during the investigation, 35,578, representing 94.7 per cent, could be accessed without authentication or any sign-in requirement.
Most of the exposed applications were games, landing pages and calculators. However, about one in 10 contained internal business or personal information, with Claroc estimating that between 650 and 800 applications held private data.
The security firm manually verified several cases, uncovering sensitive information belonging to individuals and organisations.
Among the exposed materials were the laboratory results of an intensive care patient, a hospital group’s staff roster containing details of more than 3,500 employees, and a fire department’s shift schedule.
Claroc also identified a contractor’s timesheet application containing 18 user accounts and their passwords stored in plain text. The credentials were embedded in code automatically downloaded by anyone visiting the application.
Beyond SpaceXSI and X, Claroc identified 30 organisations whose applications were exposed, including six companies listed on the Fortune 500. However, the security firm did not disclose the names of the organisations.
The findings raise concerns about data privacy and security safeguards surrounding applications created and published through AI-powered development platforms.
